Unreal Tournament Package File Format 


Version 1.6 


IReVISIOM PUIS(OL ys inaut24 Getcoauieaseteereuial eee ae ea 2 
Gio) oy 1 Bln (orek6 (c) Geeeeenen tree nee rte err ere ren rer reer eer ore Cee eer etre er eter are ten cere eet oe ree 3 
tn F¥ 0d ead Ics 0) [os eee ene een rem om ne enya ee Pn era rane ellen aco re fey: Meret teoteere en Tene On eee ae 3 
|): 010) 0 60 by) 6) (oem eee pean nee PCPInE area DRO ran ee De So Pee Tee CP ee 4 
TATA OO EL TE AOUG sos ds:cceicwoscastonssarstasciatcubircaiosa tivbticcarcneiceonssestacGatew ise sana sata dec vwisedeaeetadtensbiesenauviacsenwseseonuess 4 
FIChitaee Fable ax soto eek cadena einen eeu aan ee ee 4 
PACK AGS TAOS cade ties causa dll eke as alert aL a au dN eta adie La is a aa dh tad ade lh 4 
OFC A S55: Scot cSictn ond basses sinneta vaca ictew os paiva vas vow ae Espoo ees 5 
©) oj [0] ae Ss) fo) = (0c) gree ane tere ee a Ens ee eRe ea ee ee ere ae 6 
INVASIVE 9G lh OIA ees acaiatecalicn ist cacweserenten Wa ccauuletieaicn siaccac vealpacaeveicad an viaaeanehedin uence 6 
ININBIE) Fee Vee OULU sia tatcteacetes sada tatb he tns tenis teat atenaahadeiotcansdeareas ire eetaenannctas tes menmoneaaateeroats 6 
CVO] CCES HOPMAN sp et cen ste Crue iaaareetnnch ye enncte scan A casera Sonnac ceoegan aoe eaten ees 8 
PPE OID 1 yO lO GN cs rect manr tra rec eee cid a ae ast octet traces akan cotton ea aa 8 
GS iho) (Cig, © | 9) 16) 6 eee ae Nee en eine anni ane ae Rt nee aOR Ste on Seen ee Onn oe 1] 
CASS IC iyi cetencahivne en ihais saree cao hatcu end Mental astra banks Calcul Gott atat tad aah Calcinma Gia 1] 
CVASSUC OMS Uri cisadscisinacoaeqsestetsseslngsldaccantnavesqasteacmen boos dsa aianasdacteoundek cad sacminelon dee unas dace uaa aeteauneeenes 1] 
SIFT 1 0 ene ge nN eC Oa eR ee oe 1] 
CVass PrOpe ry ir .cxsisrssenrnsut ace tcaten dh auch ec asenecem autos iaauesie mance cc daudu cuss ana oc igtecde ue cdaiges: 12 
TASS TS VCS PROP SY a sepe Sadist ond arse h G etc aioe had aR Sard t nse adhoc Senden toe aoeeee heh. 13 
Class 7 OB SCE TOP CL Yy saoaisachsitile dense cbetedetada cae Beat da de ae cmetetata das oue Bhat eoeeeubenetededs 13 
Class: Fixed A 16a y Properly access secdentoduch send ovaden eobanlenien eeu enaieetohesiah soaycbntadatlnen veulenaitattitainiced onedeles 13 
Class Att ay RROpe ny cio sasiescangasiss tassi saat wrscaae iesatarsoss caso aeedesesneudoe muah eeusscasenwetesheeds: 13 
ClaSS Map PLO Per extvtscticacenntciyiceceatiedettbtndidncwsl ee tuloiledeehiie de utbtadidncwl ip Iniansayrubedteasabotadey 13 
C1aSS' Class POPC Ely cme swcscctcccsssnteaicsdatwonninnnteaudtonliSudunwtesiebatwouduynteowntontwnusnoeo wide iwewneuetwowdas 13 
TAS Se SPC COD CL Uy pecemsanehs tan ecaeciog een fetch Acces ian ig, pected ad eek cis aia sg. Seca aed tie eek: 14 
Classes IntProperty, BoolProperty, FloatProperty, ...........ccccccccsssssssesssseeeeececeeeeeeeeeeeeaaaaes 14 
Classes NameProperty, StrProperty, StringProperty ................cccccccccessseeeeeeceeeeeeeeeeeeaaaaes 14 
VAS Sy Catia rtircend aeeg ste cane a ats Cau ts baeaa GOs enctiaa a nck al og ee bata vasa aeadeweeenae emcees 14 
6) ad GN 01 8 | 0) 0 ge ene en ern eee aries ane ee tee eh ee eee ie eam Re er t ntee Mee ae ee Tee er 15 
TASS SCAG ax ea atseeste eat epee cea acetate race that hate aalih ae paced ee ta 16 
CVaSS uy (COr INOUG. ) ines i enenten eruniciaeetnnaetlcn tetas ha eeniet tema en eat 16 
VAS S TCX GUNG. acassdachone Saad seatevasiencuinstebans dacmescwund es aseeaisacsonndebaasdacminewstdetasieaunuadoantetaasdamuneutes 18 
BSI 2S emer eR ec cn 18 
(61 Sat 00) 0] eee eee cere en cree ete ee eee ern n cece re ent eee ener een eters een ree eters 19 
ASS TCS ERR case natn eects dae ae tec ct cieesad tees Deans denudt matress cau eateness 19 
TASS 9 OUI a. ota tanec atti eccuhan nae eeoue ane can ee ee ee 19 
VAS SSIVINISIC 20.0c otc inna tasuc crc sostaciacetie tatnle so buaducustecenn cola tean eb uonswtiadncustecean cose sisexe eauheiaceesnstacaes: 20 
UV G! VC CLOL sir aretcaccuiatetus cu araoestsiceaae tee moe tiiata seanyesemekist on taneantuteebe ons iacauateeetec oe sanoniuieebronesaae: 20 
MVC IR OLALOL sac siacetutuhint ac nadtiu aban Mavebadiunu ada dMlatuegi esa al Minti disaces Jillette datas 20 
DYE :15 OUNCII BOX saiesectatincavssnnta ateeceasaeSeceaiedead can ianarcialnaedeeceaaa Rede aedead antonio eaneai Seip 20 
BY TOU G  Ce aeseist es sip g races olseecqdnd scsectio ted sd sac ac elie eqns secs ctluaed aa sac ase wa aces 20 
TES SHINS S payee ccs cteurstoinas tae at acaace sie rca sida ici cneues eaaias en ec anaareteieadn Silene asdasses ua craaattenaeen ead coeseades: 21 
2 OF oye Ih Pon ene nee ee en ee neon Roe One ne one oe a ee Cee ee ae ene 23 
pod) Fo 207d Fox) a Een eS cet RES Oe OO RRS 24 
PEC UINGO12)6 (2) a Rem ee oan nee ote ene ment Smee eee oes ene mene nt set ee ey ce Reese ae ne ae eee 25 


S101) 0) 0N 0) 0 0 t: | ee ee ene a eee ee seen ri meee Meee eee ern n none ne me eee ety 2y 


If you find any bug in this document or you know some other information please 
tell me at acordero@acordero.org 


| Blue | This color flags any comment that could be wrong. 


This color flags unknown fields. 


/Red__ | This color is used for messages that flag differences between package versions. 





Thanks to: 

Half (from Unreal Services). 

Erik de Neve & Tim Sweeney from Epic Games. 
Scott Martin from Ion Storm. 


Revision History 


1.6 

Fixed type of AnimSeqs Count in Mesh class. 

Fixed Sound class in packages with version >=63 (thanks to Richard Wynne). 
Some small changes about compressed textures. 

Made clearer the use of LODMesh data. 

Added SkeletalMesh and Animation classes. 

Added two script opcodes for old version packages. 


1.5 
e Changes in package header. Added LicenseeMode value and clarified the 
meaning of some fields. 
e Changed property interpretation. 
e Changed Null Class interpretation and added Field, Struct, Function, State, 
Property (and its different types) classes. 
e Added script decompilation section. 


Global Header 
0x9E2A83C1 


DWORD PackageVersion Low order WORD 1s the file 

version, high order WORD is the 
LicenseeMode in newer versions 
(seems unused). 
Table 
beginning of the file 
Table 

Offset of the Export Table from the 
beginning of the file 
Table 
beginning of the file 


If Package Version<68 then 


Table 
the beginning of the file 


Else 


16 Bytes GUID 


DWORD GenerationCount Unknown meaning of “Generation”’. 
Seems to be related to 
recompilation. 


For each generation 


DWORD _|ExportCount | 
DWORD _|NameCount | 





Name Table 


NameCount elements with this format: 


NAME | ObjectName{ 
DWORD | Object Flags | See “Object Flags” 


Export Table 


ExportCount elements with this format: 


INDEX Class of the Object. See “object references”. 


INDEX | Super Parent of the Object (from which it inherits). See “object 
references’. 


DWORD | Package Package this Object resides in. Could be an internal package (a 
group). See “object references”. 


INDEX | Object Name | The Object name. It’s an index into the Name Table. 
DWORD | Object Flags See “Object Flags” 
INDEX Size of the object inside the file. 


INDEX | Serial Offset Offset of the object inside the file. This field only exists if 
SerialSize>0 


Import Table 





ImportCount elements with this format: 


INDEX | Class Package | Package of the Class. It’s an index into the Name Table. 
INDEX The Class of the Object. It’s an index into the Name Table. 


DWORD The Package this object resides in. See “object references”. 


INDEX | Object Name | The Object name. It’s an index into the Name Table. 





Heritage Table 


HeritageCount elements with this format: 


Package Flags 


PKG AllowDownload | 0x0001 | Allow downloading package 
PKG ChientOptional | 0x0002 | Purely optional for clients 
PKG ServerSideOnly | 0x0004 | Only needed on the server side 


PKG BrokenLinks 0x0008 | Loaded from linker with broken import links 
PKG_Unsecure 0x0010 
PKG Need 0Ox8000 | Client needs to download this package 





Object Flags 


RF_ HighlightedName 0x00000400 | A hardcoded name which should be syntax- 
Or highlighted. 
RF_ EliminateObject(?) 


RF_InSingularFunc 0x00000800 | In a singular function. 
Or 
RF RemappedName(?) 


RF Suppress 0x00001000 | Suppressed log name. 
Or RF StateChanged(?) 


RF Standalone 0x00080000 | Keep object around for editing even if 
unreferenced. 


RF_HasStack 0x02000000 





Object References 


Some indices do not refer to a name in the Name Table, but to other objects in the 
Export or Import tables. They work in this way: 


If the index is zero the object referenced 1s null. 


If the index<0 the object is in the Import table in the position (—index-1). 
If the index>0 the object is in the Export table in the position (index-1). 


NAME Type Format 


The NAME type changed between versions of the package format. 
If Package Version<64 then the type is like an ASCIIZ string. 
But if PackageVersion>=64 then the type also saves first the length of the string plus 


one for the zero byte. So for example, the name “Unreal” would be saved: 
0x07 os) Oia ss a i ad ‘fa? bial iad 1 0x00 


INDEX Type Format 


The INDEX type is used as a way of reducing file size. It is a DWORD saved with as 
less bytes as possible. The first byte tells 1f the number is positive or negative (bit 7, B 
&& 0x80; 1 means negative). Any byte has a bit that means that there is another byte 
following, in the first byte this 1s bit 6 (B && 0x40) and in the following 1s bit 7 (B && 
0x80). For example for number —12345: 

0x00003039 (in positive, the sign 1s flagged at the end of the conversion) 

00000000 00000000 00110000 00111001 (in binary) 


0000001 1000000 111001 (grouping, 6 bits for the most significant byte, 7 bits for 
others) 


0x01 0x40 0x39 (in hex) 
0x01 OxCO OxF9 (added the bits for the sign and for the continuation flags) 


Saved as 0xF9 0xCO 0x01, three bytes instead of four. 


The Epic package format document calls this data type Compact Indices and it says the 
following: 


Compact indices exist so that small numbers can be stored efficiently. 
An index named "Index" is stored as a series of 1-5 consecutive bytes 
with the following C++ code. Basically, the "Ar << BO" type code 
serializes the byte stored in the variable BO. Serialize can mean 
read or write, depending on the internal implementation of the archive 
object Ar. 
hid 
// FCompactIndex serializer. 
V7 
FArchive& operator<<( FArchive& Ar, FCompactIndex& I ) 
{ 
INT Original = 1I.Value; 
DWORD V Abs (I.Value) ; 
BYTE BO ((I.Value>=0) ? O : Ox80) + 
((V < 0x40) ? V: ((V & Ox3£)+0x40) ); 
EE. Verte: =. 0); 
Ar << BO; 
if( BO & 0x40 ) { 
N, SS=: 6c 
BYTE Bl = (V < 0x80) ? V: ((V & Ox7£)+0x80) ; 
Ar << Bl; 
if( Bl & Oxs0 ) { 
A) ae 
BYTE B2 = (V < 0x80) ? V: ((V & Ox7£)+0x80) ; 
Ar << B2; 
if( B2 & oxso ) { 
VY SSS ps 
BYTE B3 = (V < 0x80) ? V: ((V & Ox7£)+0x80) ; 
i eee oe le 
if( B3 & Oxso ) { 
Vi SSe> 7 
BYTE B4 = V; 
Ar << B4; 
I.Value = B4; 


T.Value = (I1.Value << 7) + (B3 & Ox7E); 
} 
T.Value = (I1.Value << 7) + (B2 & Ox7E); 
} 
IT.Value = (I1.Value << 7) + (Bl & OXx7E); 


IT.Value = (I.Value << 6) + (BO & Ox3€£); 
if ( BO & 0x80 ) I.Value = -1.Value; 
if( Ar.IsSaving() && I.Value!=Original ) 
appErrorf ("Mismatch: %08X %08X",I.Value,Original) ; 
return Ar; 


Objects format 


Each object has a different format depending on its class. The format depends on the 
Serialize function or the << operator of the class and the class ancestors (they save their 
data first). The best way to check for the object format is to read the available source 
code to see if they are published for that class and its ancestors. Sometimes you can get 
the format knowing the variables that are saved (they are published) and some 
investigation with sample objects. 


An object usually have a header, a list of properties (ended with property “None’”’) and 
specific data. 


Properties format 


A property starts with an INDEX that specify its name (in the Name Table). If the name 
is “None” the properties list has finalized. The next BYTE is an info byte for the 
property (includes its type). 


The info byte is composed of several parts. Bits 0 to 3 1s the type, bits 4 to 6 is the size 
and bit 7 is the array flag. 


The property type value means: 
| = ByteProperty 
2 = IntegerProperty 
3 = BooleanProperty 
4 = FloatProperty 
5 = ObjectProperty 
6 = NameProperty 
7 = StringProperty 
8 = ClassProperty 
9 = ArrayProperty 
10 = StructProperty 
11 = VectorProperty 
12 = RotatorProperty 
13 = StrProperty 
14 = MapProperty 
15 = FixedArrayProperty 


If the type is an struct then the struct name follows. 


The size value is interpreted in the following way: 


0 = 1 byte 
1 =2 bytes 
2 = 4 bytes 
3 = 12 bytes 
4 = 16 bytes 


5 =a byte follows with real size 
6 =a word follows with real size 
7 = an integer follows with real size 


It bit 7 1s set and its not a boolean property, the property 1s part of an array and the index 
in this array 1s specified just at this point. This only happens for array indices greater 
than 0, that is, the first element (0-based) of the array does not have bit 7 set. The array 
index value is coded in this way: If 1<128 then it is saved as a byte. If 1<16384 then it is 
saved as a word with the most significant byte OR-ed with 0x80. With a greater value, it 
is saved as an integer with the most significant byte OR-ed with 0xCO0. 


If the property is a boolean, bit 7 is the value. 
Then the property value follows (except for booleans). 


Here is how to interpret the values for each type: 


Type Value Format 
0x01 (ByteProperty) BYTE 
0x02 (IntegerProperty) DWORD 


0x03 (BooleanProperty) The real value is 1n bit 7 of 
the info byte. 


0x04 (FloatProperty) DWORD A 4-byte float. 


INDEX Object Reference value. 
See “Object References”. 
0x06 (NameProperty) INDEX Name Reference value. 
Index in to the Name 


Table. 


0x07 (StringProperty) Unknown re 


0x08 (ClassProperty) See below for some known 
classes. 


0x09 (ArrayProperty) Unknown a 


OxOA (StructProperty) See below for some known 
Structs. 


Unknown i 

Unknown 
ASCIIZ text terminator. 

Unknown _ 

re 


OxOF (FixedArrayProperty) | Unknown 





These are known classes and their format: 


WORD unknown! Used in wave/wet/fire textures. Only known 


BYTE x values are the x and y values of the drop. Seem to 
BYTE y be divided by 2 respect to the texture size. 
DWORD unknown2 





These are the known structs and their value format: 


Struct Name 


ee 
Vector DWORD x x,y,z are floating point values. 

DWORD y 

DWORD z 


Rotator DWORD pitch Pitch, yaw, roll are integer values. 
DWORD yaw 
DWORD roll 


Scale DWORD x x,y,z are floating point values. 
DWORD y 
DWORD z 
DWORD sheerrate 
BYTE sheeraxis 


PointRegion INDEX zone Zone is an object reference. See “Object 
DWORD ileaf References”’. 
BYTE zonenumber 


Some examples: 





“MipZero” would be coded: 
<MipZero name index><0x2A><Color struct name index><R><G><B><A> 


“InternalTime[0]” and “InternalTime[ 1] would be coded : 

(look in the second part bit 7 of info byte and following the position 1n the array) 
<InternalTime name index><0x22><integer> 
<InternalTime name index><0xA2><0x01><uinteger> 


Generic Objects 


All classes except the native ones inherit from the Object class that have the following 
header. 


INDEX 
INDEX 
QWORD 
DWORD 


INDEX Offset Only if 
StateFrame.Node<>0 


EndIf 
Properties. (only if object is not a Class) 


Documented exceptions (native classes) are noted in each class section. 


Class Field 













This is an abstract class, but we need it to explain the following classes since they 
inherit from it. It is also the ancestor for Const, Enum and all Property classes. It 
inherits from the generic object. 


INDEX | SuperField | Parent object. Object Reference. 





INDEX Next object in list. Object Reference. 


Class Const 


This class inherits from Field. 


INDEX This includes the ending null character. 





|ASCHZ | Constant} 


Class Enum 


This class inherits from Field. 





Name Reference. 


ArraySize 













For each element 


INDEX 


ElementName 





Class Property 


This class inherits from Field. 


|WORD | ArrayDimension [0 
WORD _|ElementSize | 
DWORD | PropertyFlags | 


INDEX 
WORD | ReplicationOffset | Only if PropertyFlags include CPF Net 





Property Flags 


CPF Edit Ox00000001 | Property is user-settable in the editor. 


CPF Const 0x00000002 | Actor's property always matches class's default 
actor property. 


CPF Input 0x00000004 | Variable is writable by the input system. 
CPF ExportObject | 0x00000008 | Object can be exported with actor. 
CPF OptionalParm | 0x00000010 | Optional parameter (af CPF Param is set). 


CPF Net 0x00000020 | Property is relevant to network replication (not 
specified in source code) 
CPF ConstRef 0x00000040 | Reference to a constant object. 


CPF Parm 0x00000080 | Function/When call parameter 
CPF OutParm 0x00000100 | Value is copied out after function call. 


CPF SkipParm 0x00000200 | Property is a short-circuitable evaluation function 
parm. 


CPF _ReturnParm _ | 0x00000400 
CPF CoerceParm | 0x00000800 | Coerce args into this function parameter 


CPF Native 0x00001000 | Property is native: C++ code is responsible for 
serializing it. 


CPF Transient 0x00002000 | Property is transient: shouldn't be saved, zero- 
filled at load time. 

CPF Config 0x00004000 | Property should be loaded/saved as permanent 
profile. 


CPF NeedCtorLink | 0x00400000 | Fields need construction/destruction (not specified 
in source code) 


Another one 1s the “private” flag that is however saved in the object flags ({RF Public). 





Class ByteProperty 


This class inherits from Property. 


INDEX | EnumType | 0 if it is a normal byte, other for a reference to the Enum type 
object. 


Class ObjectProperty 


This class inherits from Property. 


INDEX | ObjectType | Reference to the Object type object. 


Class FixedArrayProperty 


This class inherits from Property. 


INDEX | Inner | Reference to the element object. 





INDEX | Count | Size of the array. 


Class ArrayProperty 


This class inherits from Property. 


INDEX Reference to the element object. 


Class MapProperty 


This class inherits from Property. 


INDEX | Value 


: 
0 
es 
~< 
ae a 


Class ClassProperty 


This class inherits from ObjectProperty. 


INDEX Reference to class object. 


If Class is “Object” then the type is the inherited object else the type 1s object<class>. 


Class StructProperty 


This class inherits from Property. 


INDEX | StructType | Reference to the Struct object. 


Classes IntProperty, BoolProperty, FloatProperty, 
These classes inherits from Property and do not add any new data. 
Classes NameProperty, StrProperty, StringProperty 


These classes inherits from Property and do not add any new data. 


Class Struct 


This is the class for UnrealScript struct definitions. It inherits from Field. 


INDEX Object Reference. 
INDEX _ | Children First object inside the struct. Object Reference. 
INDEX | FriendlyName | Name of the struct. Name Reference. 


|DWORD |TextPos | 
|DWORD | ScriptSize | 


The real script size 1s not exactly the same as the value above since some statements 
count more than they actually occupy (any index counts four instead of the real index 
size). To know where the Script ends it 1s necessary to traverse it (decompile). 





The format of the script code 1s documented later in the document. 


Class Function 


Inherits from Struct. 


WORD 


INDEX | ReturnValueOffset | Only if Package Version<=63 
DWORD |FunctionFlags ff 
WORD | ReplicationOffset Only if FUNC_Net flag in FunctionFlags. 


To know its parameters, result type and local variables you should traverse its children 
objects. 





Function Flags 


function). 
used in source code. 


FUNC_Net 0x00000040 | Function is network-replicated. Not used 1n source 
code. 


FUNC NetReliable | 0x00000080 | Function should be sent reliably on the network. 
Not used 1n source code. 


FUNC _ Invariant 0x00010000 | Return value is purely dependent on parameters; 
no state dependencies or internal state changes. 





Class State 


This class inherits from Struct. 


QWORD | ProbeMask -[——Sss—“CS 
QWORD| IgnoreMask | —SsS—S 





LabelTableOffset | Offset of the Label Table into the script. 
DWORD | StateFlags oT 


State Flags 


STATE Editable | 0x00000001 | State should be user-selectable in UnrealEd. 
STATE Auto 0x00000002 | State is automatic (the default state). 
STATE Simulated | 0x00000004 





Class null (or “None”) 


This class inherits from State and it is the “class” of the actual classes in UnrealScript. 


DWORD OldClassRecordSize Only if 
Package_Version<=61 


|DWORD | ClassFlags | 
|GUID | ClassGuid fF 
INDEX | Dependencies Count fo 
-DWORD |Deep | 
|DWORD | ScriptTextCRC | 


INDEX | Packagelmports Count | 
If Package _Version>=62 

Object Reference. 
Name Reference. 


EndIf 


Properties (see above to decode) 





This class is the main object in any package, excluding other native classes. All other 
objects are structured inside them. 


Class Flags 


CLASS. Abstract Ox00001 | Class is abstract and can't be instantiated 
directly. 


CLASS Compiled 0x00002 | Script has been compiled successfully. 
CLASS Config 0x00004 | Load object configuration at construction time. 


CLASS _ Transient 0x00008 | This object type can't be saved; null it out at 
save time 


CLASS _Parsed 0x00010 | Successfully parsed. 


CLASS Localized 0x00020 | Class contains localized text. Not used in 
source code. 


CLASS SafeReplace 0x00040 | Objects of this class can be safely replaced with 
default or NULL. 


CLASS RuntimeStatic 0x00080 | Objects of this class are static during gameplay. 
CLASS _ NoExport 0x00100 | Don't export to C++ header. 
CLASS NoUserCreate 0x00200 | Don't allow users to create in the editor. 


CLASS PerObjectConfig | 0x00400 | Handle object configuration on a per-object 
basis, rather than per-class. 


CLASS _NativeReplication | 0x00800 | Replication handled in C++ 





Another flag is “Native” read from the object flags (RF Native). 


Class Texture 


This is a native class that does not inherit from the generic object header. 


Properties (see above to decode) 
BYTE MipMapCount Number of MipMaps 1n the texture object. 


DWORD WidthOffset Offset in file of the following Width 
DWORD.Only if PackageVersion 1s >=63 


INDEX MipMapSize Size of the graphic block 


MipMapSize MipMapData Image. One byte per pixel 
BYTEs 


DWORD Width in pixels 
DWORD Height in pixels 


BYTE BitsWidth Number of bits of Width (8 bits for 256 





















pixels) 
BYTE BitsHeight Number of bits of Height 


If the Format property exists it tell which format the mipmaps have, else use TEXF P8 
(see below). 


Some textures have compressed MipMaps after the normal MipMaps. This happens 
when the bHasComp property is True. The structure is the same as in the above table 
except that the MipMapData has a data format based on the CompFormat property. 


The Format and CompFormat properties have these values: 


Ox0O | TEXF P8 8 bits, paletted 
TEXF RGBA7 __ | 7 bits for RGBA ? 
0x02 | TEXF RGBI6 16 bits for RGB ? 


x03. | TEXF DXT1 DirectX-1 format. Search for “Opaque and One-bit Alpha 
lem Textures” in the Microsoft Platform SDK documentation. 
0x05 


Only TEXF P8 and TEXF DXT1 are known at this time. 





Class Palette 


This is a native class that does not inherit from the generic object header. 


PBYTE [Red 
PBYTE [Green P 
ee 


















BYTE 
BYTE Alpha Maybe an Alpha value? 


Class Font 


This is a native class that does not inherit from the generic object header. 


The Font objects describe the position and size of each font in a texture object. 















Class TextBuffer 


This 1s a native class that does not inherit from the generic object header. 


Pos 
INDEX | TextSize | 





Class Sound 


This is a native class that does not inherit from the generic object header. 


Properties (see above to decode) 


INDEX SoundFormat | Index into the Name Table of the sound format 
extension (WAV). 


Offset in file of next object in package. .Only if 
PackageVersion 1s >=63 
INDEX | SoundSize ff 





Class Music 


This is a native class that does not inherit from the generic object header. 


Music packages have only one Music object inside them, or at least this 1s the case for 
the original UT packages (UnrealED does not allows more than one object per 
package). The Music format (file extension) 1s the first name in the Name Table. The 
format is one of the several Tracker formats (IT, XM, MOD, etc). This objects do not 
have properties. 


WORD ChunkCount? | Always |. Could also be the index into the name 
table for the format. 


DWORD Unknown If package version>61 it’s the position of the byte 
next to ChunkData. 


INDEX ChunkSize fo 


ChunkSize ChunkData 
BYTEs 
Type Vector 








Type Rotator 


16384 correspond to 90 degress. 





Type BoundingBox 





Type BoundingSphere 





Only if Package Version > 61 


Class Mesh 


This is a native class that does not inherit from the generic object header. 





Properties (see above to decode). Seem to be only “None”. 


UT variation: 


This values do not give a Front view, but not all models have the same orientation. I don’t 
know how UT knows where is the front. 
XYZ X=(xyzZ && Ox7FF)/8 

y=((xyz >> 11) && Ox7FF)/8 

if (y>128) { y=y-256; } 


if (x>128) { x=x-256; } 





X—-X 


Z=((Kyz >> 22) && Ox3FF)/4 
if (z>128) { z=z-256; } 
DeusEx variation: 





QUADWORD XYZ X=(xyz && OxXFFFF)/256 
y=((xyz >> 16) && OXFFFF)/256 


if (y>128) { y=y-256; } 





hee 

if (x>128) { x=x-256; } 

X=-X 

Z=((xyz >> 32) && OxFFFF)/256 
if (z>128) { z=z-256; } 

INDEX | Tris Count 
WORD VertexIndexd 
WORD [Wertexindex?——SSSidS 
WORD VertexIndexs 

PBYTE | Vertex. UO 
PBYTE | Vertex, VO 
PBYTE | Vertex2 UU 
PBYTE | Vertex2 VO 
BYTE | Vertex 
PBYTE | Vertex3 VO 
PDWORD | Flags 
|DWORD | TextureIndex 
INDEX | AnimSegs Count, 
FINDEX [Name 
INDEX. {Group 
|DWORD | Start Frame 
PDWORD | Num Frames 
INDEX | Function Count, | 


PDWORD [Time 

FLOAT [Rate 
|DWORD | Connects Jump fF 
INDEX | Connects Count, fF 
|DWORD | NumVertTriangles | 
/DWORD __|TriangleListOffset | 
|BoundingBox | BoundingBox fF 
|BoundingSphere __| BoundingSphere | 
|DWORD | Verthinks Jump fF 
INDEX | Verthinks Count, fF 
|DWORD | Verthink 
INDEX | Textures Count, fF 
INDEX | BoundingBoxes Count | 
BoundingBoxes re 
INDEX ____—| BoundingSpheres Count | 
| BoundingSphere | BoundingSpheres | 
SDWORD | FrameVerts fF 
PDWORD | AnimFrames 
SDWORD OL ANDFlags 
PDWORD | ORFlags 
Vector Seale 
Vector Origin 
Rotator | RotOrigin, 
PDWORD | CurPoly 
PDWORD | CurVertex, 


If Package Version = 65 
FLOAT 
Elself Package Version >=66 
INDEX TextureLOD_ Count 
FLOAT TextureLOD 


EndIf 


Class LodMesh 


This class inherits from Mesh. The Tris array is empty in a LodMesh object. 


INDEX | CollapsePointThus Count | 
|WORD | CollapsePointThus | 
INDEX i FaceLevel Count | 
|WORD | FaceLevel | 
INDEX | Faces Count, | 
|WORD | WedgeIndex | 
|WORD | WedgeIndex2 | 
|WORD | WedgeIndex3, | 
|WORD | Materialindex, | 
INDEX | ColllapseWedgeThus Count} 
|WORD | CollapseWedgeThus | 
INDEX | Wedges Count | 
PWORD | VertexIndex, fF 
INDEX | Materials Count | 
PDWORD [Flags 
|DWORD | TextureIndex, | 
|WORD | WedgeIndext | 
|WORD | WedgeIndex2 | 
|WORD | WedgeIndex3, | 
|WORD | Materialindex, | 
|DWORD | ModelVerts P| 
SDWORD | SpecialVerts | 
/FLOAT | MeshScaleMax | 
FLOAT | LODHysteresis | 
FLOAT | LODStrength P| 
PDWORD | LODMinVerts | 
FLOAT | LODMorph 
FLOAT | LODZDisplace | 
INDEX | ReMapAnimVerts Count | 
|WORD | ReMapAnimVerts | 
|DWORD | OlldFrameVerts | 


To read the mesh you will need to get the Verts, Textures, Wedges, Faces and Materials 
arrays and the FrameVerts, AnimFrames and Special Verts values. 


The WedgelIndex1, 2, 3 values of the Faces array tell you which Wedges uses the face. 
Each Wedge has a VertexIndex that added to SpecialVertstselected_frame*FrameVerts 
gives you the vertex index into the Verts array. 


The SpecialFaces array has the weapon polygon. The WedgeIndex1, 2, 3 of this face 
has to be used a bit differently because in this case we don’t have to add the 


Special Verts value. So to find the correct vertex index just add 
selected _frame*FrameVerts to the VertexIndex value. 


The wedge S and T values give you the texture coordinates (U=S/255, V=1-T/255) and 
the faces MaterialIndex points you to the TextureIndex value in the Materials array that 
points you to the Texture object in the Textures array. 


The AnimFrames value gives you the number of frames. And you can also read the 
AnimSegqs array to get sequence names, position and duration. 


Class SkeletalMesh 


This class inherits from LodMesh. 


INDEX _—| ExtWedges Count, | 
PWORD | iVertex, 
PWORD {Flags 
FLOAT (UO 
FLOAT {VO 

INDEX | Points Count, | 
FLOAT [XP 
FLOAT [Yo 
FLOAT [Z 0 P 

INDEX _| RefSkeleton Count | 

FLOAT | BonePos.Orientation.X | 
FLOAT | BonePos.Orientation Y | 
FLOAT | BonePos.OrientationZ | 
FLOAT | BonePos.OrientationW | 

FLOAT | BonePos.PositionX | 

FLOAT | BonePos.PositionY | 

FLOAT | BonePos.PositionZ | 

FLOAT | BonePos.Length | 

FLOAT | BonePos.Xsize | 

FLOAT | BonePos.Ysize | 

FLOAT | BonePos.Zsize | 

|DWORD _|NumChildren | 

|DWORD | Parentindex | 

INDEX __| BoneWeightIdx_ Count, | 

|WORD | WeightIndex | 

PWORD [Number | 

PWORD [Detail | 

|WORD | DetaiIBO | 

INDEX __| BoneWeights Count, | 

|WORD | PointIndex | 
|WORD | BoneWeight | 

INDEX __| LocalPoints Count | 


FLOAT [XP 

FLOAT [Yo 

FLOAT [Ze P 
|DWORD __| SkeletalDepth | 
|DWORD __| WeaponBoneIndex | 
FLOAT __| WeaponAdjust.OriginX | 
FLOAT ___| WeaponAdjust.Origin Y {0 
FLOAT __| WeaponAdjust.OriginZ (0 
FLOAT __| WeaponAdjust.XaxisX [0 
FLOAT ___| WeaponAdjust.Xaxis Yo {0 
FLOAT __| WeaponAdjust.XaxisZ | 
FLOAT __| WeaponAdjust.YaxisX | 
FLOAT __| WeaponAdjust.Yaxis Yo | 
FLOAT __| WeaponAdjust.YaxisZ | 
FLOAT __| WeaponAdjust.ZaxisX | 
FLOAT __| WeaponAdjust.Zaxis Yo | 
FLOAT __| WeaponAdjust.ZaxisZ | 


This mesh can be interpreted as a LodMesh except that instead of the Verts array you 
have to use the Points array for the vertices. 





Also, you don’t have frames here, just the reference model, because the animation is at 
the assigned Animation object that animates the bone skeleton. 


Class Animation 


INDEX = ReefBones Count, | 
DWORD Flags 
|DWORD | Parentindex, | 
INDEX | Moves Count | 
FLOAT | RootSpeed3D.X fF 
FLOAT | RootSpeed3D.Yo | 
oS 
— 
oe 
es 
oo 


















INDEX AnimTracks Count Array of 
AnalogTracks 


SDWORD {Flags | 
INDEX | KeyQuat Count | 

FLOAT | KeyQuaX | 
FLOAT | KeyQuatY | 





















FLOAT | KeyQuatZ | 
FLOAT | KeyQuatWo | 
INDEX| KeyPos Count | 
FLOAT |KeyPosX | 
FLOAT |KeyPosYo | 
FLOAT |KeyPosZ | 
INDEX | KeyTime Count, | 
FLOAT |KeyTime | 
SDWORD | RootTrack.Flags | 
INDEX __| RootTrack.KeyQuat Count | 
FLOAT __| RootTrack.KeyQuatX | 
FLOAT | RootTrack.KeyQuatY | 
FLOAT | RootTrack.KeyQuatZ | 
FLOAT | RootTrack.KeyQuatW | 
INDEX __| RootTrack.KeyPos Count | 
FLOAT | RootTrack.KeyPosX | 
FLOAT | RootTrack.KeyPosYo | 
FLOAT | RootTrack.KeyPosZ | 
INDEX __| RootTrack.KeyTime Count | 
FLOAT | RootTrack.KeyTime | 


This object contains the animations for skeletal meshes. The RootTrack 1s the same type 
as the elements of the previous array AnimTracks. 



























Script Format 


The format of a struct, function, state or class script 1s complex. The code statements are 
compiled into tokens. Here are the tokens and their interpretation: 


nf Ox05 Ae * a 
TOKEN Result 


EX. Switch 


_ Pf 


EX LabelTable 





BYTE Size 
TOKEN Condition 


WORD NextOffset | Case Value: 


{TOKEN Value} 


Array of 
INDEX Name 
DWORD Offset 


Switch (Condition) { 
Size 1s the size of the Condition 


expression. The end of the switch 
is unknown except maybe for 
some hints inside it. 


EX Jump WORD Offset Goto Offset 


TOKEN Condition 
endorse 
End of State. 
TOKEN Condition 








The Value does not exist if 
NextOffset is OXFFFF meaning a 


“default” case (last one). 
This token is used as filler or as a 
placeholder in a not used optional 


parameter. You should return an 
empty string as its result. 

The array ends when Name is 
“None”. This token follows an 

EX_ Stop in an state and wil be 
aligned to 4 (filled with 

EX. Nothing). It is the last token in 
the script. 








EX GotoLabel TOKEN Value goto (Value) 
EX. EatString TOKEN Value pValue 


TOKEN RightSide 
TOKEN Array 


EX Let 


TOKEN Valuel 
TOKEN Value2 


TOKEN Value3 
TOKEN Value4 


EX ClassContext INDEX Class ClassName.ObjectName 


new 
(Valuel, Value2, Value3, Value4) 





WORD wskip 

BYTE bSize 

INDEX Object 

INDEX Class Class<ClassName>( Value) 
TOKEN Value The “Class” word at the start is 


EX MetaCast Ox13 
fixed. 

TOKEN LeftSide | LeftSide=RightSide 

TOKEN RightSide | In version 61 packages seems to 
be a label table at the start of the 
script. 

Ox15 | [TOKEN Value] Only seen 1n version 61 packages. 

If at the end of the script it does 

not have any parameter. In other 

places it resolves to the token 

value. 


ee | ee 

Sei 
TOKEN Value 

ee COCOCOCCC#*SOTY 


xlA | TOKEN Index Array| Index | 
TOKEN Array 


xl1B | INDEX Name Name ( 
Parameters follow until 
EX_EndFunctionParms. 


xI1C | INDEX Object ObjectName ( 
Parameters follow until 
EX_EndFunctionParms. 
Depending on the relation between 
the current function and this 
funcion it could be preceded with 
“Super.” or “Super(class).” 


EX_LetBool 





Unknown 





EX EndFunctionParms | 0x1 
EX Self Ox 1 
Ox1 

x1 


EX Skip 


i) 
~ 
— 


6 
7 
8 
EX_ Context 9 
EX_ArrayElement 


— 


S S S S 
S, 


EX_VirtualFunction 


EX_FinalFunction 





EX_IntConst x1D_| DWORD Value 
EX FloatConst OxlE_| FLOAT Value 


EX_StringConst xIF_| ASCIIZ Value 
EX_ObjectConst x2 INDEX Object ObjectClass’ObjectName’ 
EX_NameConst 0x21__| INDEX Name 


EX_RotationConst DWORD Pitch rot(Pitch, Yaw,Roll) 
DWORD Yaw 
DWORD Roll 

EX_VectorConst FLOAT x vect(x,y,Z) 
FLOAT y 


|) 
>|" 





0x25 
0x27 
0x29 


a a, 
a a 
No No 
ON > 





= 
‘. 

No 
oe) 


EX_NoObject Ox2A [Nome 


Only seen in version 61 packages. 





Seems to be a type cast. Resolves 


Unknown Ox2B | BYTE Unknown 
TOKEN Value 
7 the token value. 


EX_IntConstByte TOKEN Value 
EX EX Dynamic TOKEN Value . 


TOKEN Value 
hice Iterator Ox2F | TOKEN Value ForEach Value { 
WORD Offset 


Offset points to the 

EX_IteratorPop 0x30 This occurs when the iterator must 
jump to the next element. Does not 
show in source code and precedes 
an EX IteratorNext or appears 
before a Goto if a Continue was 
used. 


EX. IteratorNext (end of foreach) 

EX_IteratorNext Pa | ae 
EX. StructCmpEq hal INDEX Struct Valuel == Value2 

TOKEN Valuel 

TOKEN Value2 
EX_StructCmpNe 0x33 | INDEX Struct Valuel != Value2 

TOKEN Valuel 

TOKEN Value2 


EX_UnicodeStringCons tear a 


aa 


EX. Se INDEX SADEXOne wee ObjectName 
a Value 


0x37 


'= uae a Xe Name Soe Name ( 
Parameters follow until 
EX_EndFunctionParms. 


EX_StringToName 0x46 | TOKEN Value name( Value) 
Not defined in UT source, but used 
in unrealscript. 

















0x56 
0x58 
2 


to 


Any offset is in Script units, that is, taking into account that any INDEX value in the 
tokens adds four bytes instead of the real serialized size. 





Any value >= EX_ExtendedNative should be treated as a Native function call. 
If (b && OxFO) == EX ExtendedNative then it is an extended native function, you 
should read another byte and calculate its value with: 

Native=(token-EX ExtendedNative)<<8 + SecondToken 


Native should be >=EX_ FirstNative. 


If the Native function 1s a “Function” or “Event” the result 1s NatrveName(parameters) 
as the EX VirtualFunction token. 


If it is a “PreOperator” you should read another token and the result is 
NativeName+Token (the two joined, without the plus sign). An EX EndFunctionParms 
token follows, discard it. 


If it is a “PostOperator” you should read another token and the result 1s 
Token+NativeName (the two joined, without the plus sign). An EX EndFunctionParms 
token follows, discard it. 


If it is an “Operator” you should read two tokens and the result is 
Token!+NativeName+Token2 (the three joined, without the plus signs). An 
EX_EndFunctionParms token follows, discard it. 


To know the name and type of the native functions you will have to find them 1n all the 
packages of the game and extract this information (friendlyname and functionflags at 
least). 


